Apparatus and method for collecting and analyzing communications data

• US 8,873,410 B2
• Filed: 12/20/2011
• Issued: 10/28/2014
• Est. Priority Date: 11/24/1998
• Status: Expired due to Term

• Current Assignee: Niksun, Inc.
• Original Assignee: Niksun, Inc.
• Inventors: Pruthi, Parag, Heybey, Andrew
• Primary Examiner(s): Phillips, Hassan
• Assistant Examiner(s): DUONG, DUC T
• Application Number:
  US13/330,911
• Publication Number:
  US 20120092343A1
• Time in Patent Office: 1,043 Days
• Field of Search: None
• US Class Current: 370/252
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5061 characterised by the interaction between service providers and their network customers, e.g. customer relationship management
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0858 One way delays
• CPC Class Codes: H04L 43/0864 Round trip delays
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/091 Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: Y04S 40/00 Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them

Abstract

A method of monitoring data on a first communication line. Data is received from the first communication line (402) and a plurality of packets (406) are extracted (416) from the data. Statistics are then recursively generated (408), the statistics corresponding to the plurality of packets.

Claims

1. A method of displaying one or more packet properties or statistics on a display device having a display area, the one or more packet properties or statistics corresponding to packets received from a first communication line, the method comprising:

(a) displaying at least one parameter defining a subset of the packets received from the first communication line, in a first portion of the display area, wherein the at least one parameter is displayed in at least one user input field and wherein the at least one parameter includes a maximum number of listings and the at least one user input field includes a maximum field for receiving the maximum number of listings;

(b) displaying a table generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a second portion of the display area, wherein displaying the table comprises displaying the table of the one or more packet properties or statistics including only the one or more packet properties or statistics corresponding to the defined subset of the packets within the maximum number of listings received in the maximum field; and

(c) displaying a plot generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a third portion of the display area, the plot having two axes, the packet properties or statistics being represented on one axis of the plot, and time represented on the other axis of the plot.

2. The method according to claim 1 wherein the packets correspond to a plurality of protocols at a protocol layer wherein step (b) includes displaying a table listing each of the plurality of protocols of packets in the defined subset and corresponding statistics.

3. The method according to claim 2, further comprising the steps of detecting selection of one of the plurality of protocols and updating at least one of the table to display packet properties corresponding to packets of the selected protocol or the plot to display a packet properties of the selected protocol.

4. The method according to claim 2, further comprising the steps of detecting selection of one of the plurality of protocols and updating the plot to simultaneously display both the packet properties of the selected protocol and the packet properties of all protocols.

5. The method according to claim 1,wherein the packets are received from the first communication line during an interval of time, the method further comprising the steps of:

receiving a selection of a sub-interval of time less than the interval of time by one of entry of times in a text field and selection of a time interval along the time axis of the plot; and

updating at least one of the tables and the plots responsive to the selected sub-interval of time.

6. The method according to claim 1,wherein the subset corresponds to a time interval, the method further comprising the steps of receiving a start time and an end time spanning a duration longer than the time interval and updating at least one of the tables and the plots to correspond to the duration.

7. The method according to claim 1 wherein a subset of the packets correspond to a host and the method further comprises detecting selection of the host and displaying statistics corresponding to the subset of packets.

8. The method according to claim 1 wherein the packets correspond to a plurality of protocols and a subset of the packets correspond to one of the plurality of the protocols and the method further comprises detecting selection of the one of the plurality of the protocols and displaying statistics corresponding to the selected one of the plurality of protocols.

9. The method of claim 1, wherein the at least one parameter defines a resolution and the at least one user input field includes at least one interval field for defining the resolution and wherein the displaying the plot comprises:

displaying the plot of the one or more packet properties or statistics based on the defined resolution including only the one or more packet properties or statistics corresponding to the defined subset of the packets.

10. The method of claim 9, further comprising:

regenerating the displayed plot in the third portion in response to a change to the resolution defined in the at least one interval field.

11. The method of claim 1, wherein the at least one user input field is a packet filter field for defining a subset of packets and wherein the displaying the table comprises:

displaying the table of the one or more packet properties or statistics including only the one or more packet properties or statistics corresponding to the defined subset.

12. The method of claim 11, further comprising:

regenerating the displayed table in the third portion in response to a change to the packet type received in the packet filter field.

13. The method of claim 1, further comprising:

displaying at least one performance table.

14. The method of claim 1, further comprising:

displaying a view packets selector in a fourth portion of the display area; and

displaying a packet list including packet properties for all packets within the defined subset of the packets in response to selection of the view packet selector.

15. A system for monitoring a computer network over an interval of time, in which data packets travel across network paths during such time interval, the system comprising:

means for recording the packets substantially continuously during the time interval;

means for extracting packet properties from the recorded packets at multiple, successive sampling times during said time interval, the time from the beginning of the time interval to successive sampling times defining subintervals of time during which the network has been monitored, the subintervals being increasingly longer as packet properties are extracted over successive sampling times during the time interval;

means for tabulating the extracted packet properties for the subintervals to create statistical information;

means for displaying at least one parameter defining a subset of the recorded packets, in a first portion of the display area;

means for displaying a table generated from the packet properties or the statistical information corresponding to the defined subset of the packets, in a second portion of the display area; and

means for displaying a plot generated from the packet properties or the statistical information corresponding to the defined subset of the packets, in a third portion of the display area.

16. The system of claim 15, wherein the recording means includes:

means for detecting the packets travelling over a selected one of the network paths;

means for indexing the detected packets;

means for creating records corresponding to the packets; and

means for storing the records in memory.

17. The system of claim 16, wherein the detecting means includes means for determining packet properties and means for selecting certain ones of the data packets traveling the network path and having a predetermined packet property.

18. The system of claim 16, wherein the indexing means comprises means for timestamping the data packets.

19. The system of claim 18, in which the network is monitored at two points on the network, the system further comprising timestamping means at the two points, and wherein the timestamping means comprises GPS means for synchronizing the indexing of the data packets at the two points.

20. The system of claim 16 further comprising a computer with a data storage device, a network card having network card memory, and a CPU in logical communication with the network card, and wherein the record storing means comprises:

means for storing the records on the network card memory;

means for detecting relative inactivity of the CPU; and

means for transferring records stored on the network card memory to the data storage device in response to detection of the relative inactivity of the CPU.

21. The system of claim 20, wherein the record storing means further comprises:

a long-term storage device having replaceable storage media loaded therein so as to receive data thereon, and a magazine of additional storage media operatively connected to the long-term storage device;

means for detecting when the data storage device of the computer contains a predetermined amount of data corresponding to the recorded packets, said predetermined amount of data corresponding to the data storage device being full;

means for transferring said data from the data storage device to the long-term storage device in response to detecting the data storage device is full;

means for detecting when the replaceable media loaded in the long-term storage device is full; and

means for replacing the full storage media with storage media from the magazine.

22. The system of claim 15, wherein the displaying means includes a computer display screen having a graphical user interface and a control program for the graphical user interface, the control program having:

means for displaying at least some of the packet properties over time on a graph having two axes, the packet properties being represented on one axis of the graph, the time being represented on the other axis of the graph;

means for varying the timescale of the graph in response to user selection; and

means for displaying at least some of the statistical information in at least one table adjacent to the graph, the tables having user-selectable cells therein; and

means, responsive to selection of one of the cells, for displaying additional statistical information corresponding to the selected cell.

23. The system of claim 15, wherein the means for displaying the at least one parameter defining the subset includes means for displaying the at least one parameter in at least one user input field.

24. The system of claim 23, wherein the at least one user input field includes at least one time field for defining a sub time interval that is less than the time interval and wherein the means for displaying said graphical representation displays said graphical representation including only the statistical information corresponding to the defined subset of the packets within the time interval defined in the at least one time field.

25. The system of claim 23, wherein the at least one parameter defines a resolution and the at least one user input field includes at least one interval field for defining the resolution and wherein the means for displaying the plot comprises means for displaying the plot of the one or more packet properties or statistics based on the defined resolution including only the one or more packet properties or statistics corresponding to the defined subset of the packets.

26. The system of claim 25, wherein the means for displaying said plot further comprises:

means for regenerating said graphical representation in the second portion of the display area in response to a change to the resolution defined in the at least one interval field.

27. A method of displaying one or more packet properties or statistics on a display device having a display area comprising at least one user input field for specifying either numeric representation or textual representation, the one or more packet properties or statistics corresponding to packets received from a first communication line, the method comprising:

(a) displaying at least one parameter defining a subset of the packets received from the first communication line, in a first portion of the display area;

(b) displaying a table generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a second portion of the display area, wherein the displaying the table comprises displaying the table with a numeric representation of IP addresses corresponding to the one or more packet properties or statistics when numeric representation is specified and displaying the table with a textual representation of the IP addresses corresponding to the one or more packet properties or statistics when textual representation is specified;

(c) displaying a plot generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a third portion of the display area, the plot having two axes, the packet properties or statistics being represented on one axis of the plot, and time represented on the other axis of the plot.

28. A method of displaying one or more packet properties or statistics on a display device having a display area, the one or more packet properties or statistics corresponding to packets received from a first communication line, the method comprising:

(a) displaying at least one parameter defining a subset of the packets received from the first communication line, in a first portion of the display area, wherein the at least one parameter is displayed in at least one user input field and wherein the at least one parameter is a forward command and a backward command and the at least one user input field includes a forward button and a backward button for receiving the forward and backward commands;

(b) displaying a table generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a second portion of the display area wherein the displaying the table comprises updating the displayed table in the second portion in response to selection of the forward or backward command while maintaining correspondence among different portions of the display area; and

(c) displaying a plot generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a third portion of the display area, the plot having two axes, the packet properties or statistics being represented on one axis of the plot, and time represented on the other axis of the plot.

29. A method of displaying one or more packet properties or statistics on a display device having a display area, the one or more packet properties or statistics corresponding to packets received from a first communication line, the method comprising:

(a) displaying at least one parameter defining a subset of the packets received from the first communication line, in a first portion of the display area

(b) displaying a table generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a second portion of the display area;

(c) displaying a plot generated from the one or more packet properties or statistics corresponding to the defined subset of the packets, in a third portion of the display area, the plot having two axes, the packet properties or statistics being represented on one axis of the plot, and time represented on the other axis of the plot;

(d) displaying a recommendation selector in a fourth portion of the display area; and

(e) displaying at least one of capacity recommendations or bandwidth recommendations based on the defined subset of the packets in response to selection of the recommendation selector.